Dependabit

dependabit / manifest/src / mergeManifests

Function: mergeManifests() ​

ts
function mergeManifests(
   existing, 
   updated, 
   options?): {
  dependencies: {
     accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http";
     auth?: {
        secretEnvVar?: string;
        type: "token" | "oauth" | "basic" | "none";
     };
     changeHistory: {
        detectedAt: string;
        falsePositive: boolean;
        issueNumber?: number;
        newVersion?: string;
        oldVersion?: string;
        severity: "breaking" | "major" | "minor";
     }[];
     currentStateHash: string;
     currentVersion?: string;
     description?: string;
     detectedAt: string;
     detectionConfidence: number;
     detectionMethod:   | "llm-analysis"
        | "manual"
        | "package-json"
        | "requirements-txt"
        | "code-comment";
     id: string;
     lastChanged?: string;
     lastChecked: string;
     monitoring?: {
        checkFrequency: "hourly" | "daily" | "weekly" | "monthly";
        enabled: boolean;
        ignoreChanges: boolean;
        severityOverride?: "breaking" | "major" | "minor";
     };
     name: string;
     referencedIn: {
        context?: string;
        file: string;
        line?: number;
     }[];
     type:   | "reference-implementation"
        | "schema"
        | "documentation"
        | "research-paper"
        | "api-example"
        | "other";
     url: string;
  }[];
  generatedAt: string;
  generatedBy: {
     action: string;
     llmModel?: string;
     llmProvider: string;
     version: string;
  };
  repository: {
     branch: string;
     commit: string;
     name: string;
     owner: string;
  };
  statistics: {
     averageConfidence: number;
     byAccessMethod: Record<string, number>;
     byDetectionMethod: Record<string, number>;
     byType: Record<string, number>;
     falsePositiveRate?: number;
     totalDependencies: number;
  };
  version: "1.0.0";
};

Defined in: packages/manifest/src/manifest.ts:246

Merges an updated manifest generated by the detector over an existing one, optionally preserving manual entries and accumulated change history.

Parameters ​

ParameterTypeDescription
existing{ dependencies: { accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http"; auth?: { secretEnvVar?: string; type: "token" | "oauth" | "basic" | "none"; }; changeHistory: { detectedAt: string; falsePositive: boolean; issueNumber?: number; newVersion?: string; oldVersion?: string; severity: "breaking" | "major" | "minor"; }[]; currentStateHash: string; currentVersion?: string; description?: string; detectedAt: string; detectionConfidence: number; detectionMethod: | "llm-analysis" | "manual" | "package-json" | "requirements-txt" | "code-comment"; id: string; lastChanged?: string; lastChecked: string; monitoring?: { checkFrequency: "hourly" | "daily" | "weekly" | "monthly"; enabled: boolean; ignoreChanges: boolean; severityOverride?: "breaking" | "major" | "minor"; }; name: string; referencedIn: { context?: string; file: string; line?: number; }[]; type: | "reference-implementation" | "schema" | "documentation" | "research-paper" | "api-example" | "other"; url: string; }[]; generatedAt: string; generatedBy: { action: string; llmModel?: string; llmProvider: string; version: string; }; repository: { branch: string; commit: string; name: string; owner: string; }; statistics: { averageConfidence: number; byAccessMethod: Record<string, number>; byDetectionMethod: Record<string, number>; byType: Record<string, number>; falsePositiveRate?: number; totalDependencies: number; }; version: "1.0.0"; }The current on-disk manifest.
existing.dependencies{ accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http"; auth?: { secretEnvVar?: string; type: "token" | "oauth" | "basic" | "none"; }; changeHistory: { detectedAt: string; falsePositive: boolean; issueNumber?: number; newVersion?: string; oldVersion?: string; severity: "breaking" | "major" | "minor"; }[]; currentStateHash: string; currentVersion?: string; description?: string; detectedAt: string; detectionConfidence: number; detectionMethod: | "llm-analysis" | "manual" | "package-json" | "requirements-txt" | "code-comment"; id: string; lastChanged?: string; lastChecked: string; monitoring?: { checkFrequency: "hourly" | "daily" | "weekly" | "monthly"; enabled: boolean; ignoreChanges: boolean; severityOverride?: "breaking" | "major" | "minor"; }; name: string; referencedIn: { context?: string; file: string; line?: number; }[]; type: | "reference-implementation" | "schema" | "documentation" | "research-paper" | "api-example" | "other"; url: string; }[]-
existing.generatedAtstring-
existing.generatedBy{ action: string; llmModel?: string; llmProvider: string; version: string; }-
existing.generatedBy.actionstring-
existing.generatedBy.llmModel?string-
existing.generatedBy.llmProviderstring-
existing.generatedBy.versionstring-
existing.repository{ branch: string; commit: string; name: string; owner: string; }-
existing.repository.branchstring-
existing.repository.commitstring-
existing.repository.namestring-
existing.repository.ownerstring-
existing.statistics{ averageConfidence: number; byAccessMethod: Record<string, number>; byDetectionMethod: Record<string, number>; byType: Record<string, number>; falsePositiveRate?: number; totalDependencies: number; }-
existing.statistics.averageConfidencenumber-
existing.statistics.byAccessMethodRecord<string, number>-
existing.statistics.byDetectionMethodRecord<string, number>-
existing.statistics.byTypeRecord<string, number>-
existing.statistics.falsePositiveRate?number-
existing.statistics.totalDependenciesnumber-
existing.version"1.0.0"-
updated{ dependencies: { accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http"; auth?: { secretEnvVar?: string; type: "token" | "oauth" | "basic" | "none"; }; changeHistory: { detectedAt: string; falsePositive: boolean; issueNumber?: number; newVersion?: string; oldVersion?: string; severity: "breaking" | "major" | "minor"; }[]; currentStateHash: string; currentVersion?: string; description?: string; detectedAt: string; detectionConfidence: number; detectionMethod: | "llm-analysis" | "manual" | "package-json" | "requirements-txt" | "code-comment"; id: string; lastChanged?: string; lastChecked: string; monitoring?: { checkFrequency: "hourly" | "daily" | "weekly" | "monthly"; enabled: boolean; ignoreChanges: boolean; severityOverride?: "breaking" | "major" | "minor"; }; name: string; referencedIn: { context?: string; file: string; line?: number; }[]; type: | "reference-implementation" | "schema" | "documentation" | "research-paper" | "api-example" | "other"; url: string; }[]; generatedAt: string; generatedBy: { action: string; llmModel?: string; llmProvider: string; version: string; }; repository: { branch: string; commit: string; name: string; owner: string; }; statistics: { averageConfidence: number; byAccessMethod: Record<string, number>; byDetectionMethod: Record<string, number>; byType: Record<string, number>; falsePositiveRate?: number; totalDependencies: number; }; version: "1.0.0"; }The freshly-detected manifest to merge.
updated.dependencies{ accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http"; auth?: { secretEnvVar?: string; type: "token" | "oauth" | "basic" | "none"; }; changeHistory: { detectedAt: string; falsePositive: boolean; issueNumber?: number; newVersion?: string; oldVersion?: string; severity: "breaking" | "major" | "minor"; }[]; currentStateHash: string; currentVersion?: string; description?: string; detectedAt: string; detectionConfidence: number; detectionMethod: | "llm-analysis" | "manual" | "package-json" | "requirements-txt" | "code-comment"; id: string; lastChanged?: string; lastChecked: string; monitoring?: { checkFrequency: "hourly" | "daily" | "weekly" | "monthly"; enabled: boolean; ignoreChanges: boolean; severityOverride?: "breaking" | "major" | "minor"; }; name: string; referencedIn: { context?: string; file: string; line?: number; }[]; type: | "reference-implementation" | "schema" | "documentation" | "research-paper" | "api-example" | "other"; url: string; }[]-
updated.generatedAtstring-
updated.generatedBy{ action: string; llmModel?: string; llmProvider: string; version: string; }-
updated.generatedBy.actionstring-
updated.generatedBy.llmModel?string-
updated.generatedBy.llmProviderstring-
updated.generatedBy.versionstring-
updated.repository{ branch: string; commit: string; name: string; owner: string; }-
updated.repository.branchstring-
updated.repository.commitstring-
updated.repository.namestring-
updated.repository.ownerstring-
updated.statistics{ averageConfidence: number; byAccessMethod: Record<string, number>; byDetectionMethod: Record<string, number>; byType: Record<string, number>; falsePositiveRate?: number; totalDependencies: number; }-
updated.statistics.averageConfidencenumber-
updated.statistics.byAccessMethodRecord<string, number>-
updated.statistics.byDetectionMethodRecord<string, number>-
updated.statistics.byTypeRecord<string, number>-
updated.statistics.falsePositiveRate?number-
updated.statistics.totalDependenciesnumber-
updated.version"1.0.0"-
options{ preserveHistory?: boolean; preserveManual?: boolean; }Merge strategy options.
options.preserveHistory?boolean-
options.preserveManual?boolean-

Returns ​

ts
{
  dependencies: {
     accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http";
     auth?: {
        secretEnvVar?: string;
        type: "token" | "oauth" | "basic" | "none";
     };
     changeHistory: {
        detectedAt: string;
        falsePositive: boolean;
        issueNumber?: number;
        newVersion?: string;
        oldVersion?: string;
        severity: "breaking" | "major" | "minor";
     }[];
     currentStateHash: string;
     currentVersion?: string;
     description?: string;
     detectedAt: string;
     detectionConfidence: number;
     detectionMethod:   | "llm-analysis"
        | "manual"
        | "package-json"
        | "requirements-txt"
        | "code-comment";
     id: string;
     lastChanged?: string;
     lastChecked: string;
     monitoring?: {
        checkFrequency: "hourly" | "daily" | "weekly" | "monthly";
        enabled: boolean;
        ignoreChanges: boolean;
        severityOverride?: "breaking" | "major" | "minor";
     };
     name: string;
     referencedIn: {
        context?: string;
        file: string;
        line?: number;
     }[];
     type:   | "reference-implementation"
        | "schema"
        | "documentation"
        | "research-paper"
        | "api-example"
        | "other";
     url: string;
  }[];
  generatedAt: string;
  generatedBy: {
     action: string;
     llmModel?: string;
     llmProvider: string;
     version: string;
  };
  repository: {
     branch: string;
     commit: string;
     name: string;
     owner: string;
  };
  statistics: {
     averageConfidence: number;
     byAccessMethod: Record<string, number>;
     byDetectionMethod: Record<string, number>;
     byType: Record<string, number>;
     falsePositiveRate?: number;
     totalDependencies: number;
  };
  version: "1.0.0";
}

A new manifest object (does not mutate either input).

NameTypeDefault valueDefined in
dependencies{ accessMethod: "context7" | "arxiv" | "openapi" | "github-api" | "http"; auth?: { secretEnvVar?: string; type: "token" | "oauth" | "basic" | "none"; }; changeHistory: { detectedAt: string; falsePositive: boolean; issueNumber?: number; newVersion?: string; oldVersion?: string; severity: "breaking" | "major" | "minor"; }[]; currentStateHash: string; currentVersion?: string; description?: string; detectedAt: string; detectionConfidence: number; detectionMethod: | "llm-analysis" | "manual" | "package-json" | "requirements-txt" | "code-comment"; id: string; lastChanged?: string; lastChecked: string; monitoring?: { checkFrequency: "hourly" | "daily" | "weekly" | "monthly"; enabled: boolean; ignoreChanges: boolean; severityOverride?: "breaking" | "major" | "minor"; }; name: string; referencedIn: { context?: string; file: string; line?: number; }[]; type: | "reference-implementation" | "schema" | "documentation" | "research-paper" | "api-example" | "other"; url: string; }[]-packages/manifest/src/schema.ts:145
generatedAtstring-packages/manifest/src/schema.ts:130
generatedBy{ action: string; llmModel?: string; llmProvider: string; version: string; }-packages/manifest/src/schema.ts:131
generatedBy.actionstring-packages/manifest/src/schema.ts:132
generatedBy.llmModel?string-packages/manifest/src/schema.ts:135
generatedBy.llmProviderstring-packages/manifest/src/schema.ts:134
generatedBy.versionstring-packages/manifest/src/schema.ts:133
repository{ branch: string; commit: string; name: string; owner: string; }-packages/manifest/src/schema.ts:138
repository.branchstring-packages/manifest/src/schema.ts:141
repository.commitstring-packages/manifest/src/schema.ts:142
repository.namestring-packages/manifest/src/schema.ts:140
repository.ownerstring-packages/manifest/src/schema.ts:139
statistics{ averageConfidence: number; byAccessMethod: Record<string, number>; byDetectionMethod: Record<string, number>; byType: Record<string, number>; falsePositiveRate?: number; totalDependencies: number; }-packages/manifest/src/schema.ts:147
statistics.averageConfidencenumber-packages/manifest/src/schema.ts:152
statistics.byAccessMethodRecord<string, number>-packages/manifest/src/schema.ts:150
statistics.byDetectionMethodRecord<string, number>-packages/manifest/src/schema.ts:151
statistics.byTypeRecord<string, number>-packages/manifest/src/schema.ts:149
statistics.falsePositiveRate?number-packages/manifest/src/schema.ts:153
statistics.totalDependenciesnumber-packages/manifest/src/schema.ts:148
version"1.0.0"ManifestVersionSchemapackages/manifest/src/schema.ts:129

Remarks ​

The merge strategy is:

  • All entries from updated are taken as the new ground truth.
  • If preserveManual is true (default), manual entries in existing that are absent from updated are appended as-is.
  • If preserveHistory is true (default), any changeHistory from existing is prepended to the corresponding entry in updated.

Statistics are recalculated from the merged dependency list.

Use When ​

Applying the output of Detector to an existing manifest without losing manually-curated entries or historical change records.

Avoid When ​

You want to completely replace the existing manifest — just write updated directly via writeManifest.

Never ​

  • Matching between existing and updated uses id or url. If the URL of a dependency changes (e.g. a redirect is resolved), the entry will be treated as new and history will not be preserved.
  • preserveManual: true can re-add entries that were intentionally removed from the repository. Set it to false when performing a deliberate full refresh.

Released under the MIT License.

Copyright © 2026 Pradeep Mouli